# Judge 0: engineering risk and reversibility (2026-09-30)
All three converge on the same skeleton (fast PR lane, merge queue runs full suite, no push:main re-run, deploy tip, canary + auto-rollback). They differ in order of migration and in how honest their numbers are.

## Ranking
| Rank | Proposal | Why |
|---|---|---|
| 1 | P2 reliability-first | Safest order: fixes deploy-tip and vCPU launch retries first (cheap, reversible), adds always-on drift set to PR lane BEFORE the queue exists, flake quarantine with 7-day fix-or-delete, queue only at step 5. Directly targets the measured red-main causes (drift pins, one repeat test, VcpuLimitExceeded). Keeps dangerous-diff hold. |
| 2 | P0 throughput-first | Good mechanics (same required names on merge_group, one-day shadow of auto-merge-all). Riskier: deletes 3,516-line guard at step 5 with one day shadow; drops 30-min batching; biggest unbacked numbers. |
| 3 | P1 cost-first | Adds quality risk the goal forbids: cheaper review model on small PRs, semgrep/evals/drift checks to nightly advisory (drift checks are the #1 red-main cause; moving them off-path is backwards). Cost target is based on the wrong baseline. |

## Winner: P2, with grafts
| Graft | From | Why |
|---|---|---|
| Publish same required check names on pull_request and merge_group, in one PR | P0 | Otherwise the queue stalls |
| Run auto-merge-all in shadow alongside the queue before deletion (make it ~1 week, not 1 day) | P0 | Reversibility |
| One verdict per head SHA, cancel review before the model call on new push, token/$ footer on every review | P1 / P0 | Review cost is unmeasured today; measure first |
| One reusable RunsOn runner spec (163 copies -> 1) | P1 (also P2) | Mechanical, cuts config drift |
| Delete no-op satellites first (claude.yml on every event, docs fence, dependabot gate, POC) | P0 PR1 | ~12 of 22 runs/push do no work (FACT), zero risk |
| Do NOT graft: tiered cheaper review model, drift checks to nightly | P1 | Quality risk; drift = main red-main cause |

## Disputed numbers
| Claim | Where | Dispute |
|---|---|---|
| Runner "$6.6k/month today" | P0, P1 | Is Sep 29 ($219/day, bad spot day) x30. Same source says normal days are $8-20/day (~$240-600/mo). Not a monthly baseline. |
| "$450/month target" | P1 | Roughly equals a normal day today; ignores 8-core share and on-demand fallback. Savings claim vs $6.6k is inflated. |
| "$1.6k/month target" | P0 | Derived from the $6.6k spike baseline. |
| "$750 CI + $325 review" | P2 | EST from 5,437 PRs x min x $0.05; does not reconcile with Cost Explorer. Review runs on runners at ~4-8 min, the $ is mostly tokens (unlogged). |
| Red main "16% FACT" | P0, P1 | n=25 (4 of 25). The larger sample is 202/1,000 = 20% (P2). Use 20%. |
| "Drift pins ~69% of red main" | P2 | Share of failing test LINES (215/313), not runs; one inventory failure prints ~5 lines. Direction right, % overstated. Recount per failed run. |
| Merges/day "181 now" vs "341" | P0/P2 vs P1 | 181/day is main commits (5,440/30d); 341 is merged PRs on Sep 29 only. Different units. |
| Capacity 800-1,000 merges/day | all | Queue math, no measurement; also exceeds any observed demand. Irrelevant to goal, drop. |
| Red main -70/-80/-85%, to <3% | all | Estimates; plausible for drift class only after queue; flake + infra share not measured per run. |
| Machine-min per PR 48 / 60 / 75 | P1/P0/P2 | All EST; P1 assumes pushes/PR drop 3.2 -> 2.2 from review rules (unmeasured). |
| PR->prod ~50 min / 0.9 h | all | EST; today's baseline ranges 0.4 h (pr-lifecycle) to 1.13 h (earlier audit), unreconciled. |

## Engineering risks to watch (all proposals)
| Risk | Reversal path |
|---|---|
| Merge queue + auto-merge guard interaction (dangerous-diff hold) | Keep hold as a required check; queue can be disabled in repo settings in one click |
| Deleting push:main CI | Keep a nightly full run on main for 2 weeks as a backstop |
| Auto-rollback on noisy probe | Two signals must fail; probe Willows test property only |
| Flake quarantine graveyard | Nightly count, 7-day fix-or-delete |